Category Archives: Exchange

SharePoint Alerts, External Users, and Exchange Relay

 

One of SharePoint’s nicer features is a rich alert system which supports change driven e-mail based alerts.  Configuring SharePoint and Exchange Server 2007 to e-mail alerts is relatively straight forward for internal e-mail clients (I.E. those e-mail clients which are actually hosted by your Exchange Server).  Configuration becomes much more difficult if you are attempting to alert SharePoint users at e-mail addresses which are NOT hosted on your Exchange Server.  To accomplish this feat, you must relay the e-mail.

This is where the fun begins!

The Scenario
Your e-mail address is internal@yourcompany.com.  Your SharePoint install at http://portal.yourcompany.com is setup to alert you of any changes to your document libraries.  All is well in the world!

A new user is introduced to your SharePoint user list with an e-mail address of external@hotmail.com.  This new user reports he is not receiving any alerts from SharePoint.

A quick review of the logs reveals the following error:

#160009: The e-mail address ‘external@hotmail.com’ is unknown.

Root Problem
Your exchange server is setup to disallow relaying.  Under the hood, SharePoint is receiving the following error from Exchange:

550 5.7.1 Unable to relay

Solution
Enable relaying for your SharePoint server.  Easy huh? Well… sort of.

STEP#1
Open Exchange Management Console and navigate to Server Configuration –> Hub Transport.  Find the Receive Connectors tab.  You should see something similar to the image below:

image

STEP#2
Open the Receive connector and note all of the settings on each screen.  Take good notes as you will need the settings later.
They will look similar to the images below:

imageimageimageimage
SCREEN#1              SCREEN#2              SCREEN#3               SCREEN#4

STEP#3
Remove the receive connector by right clicking on the connector and selecting Remove.
Why do we do this?  Because Exchange Server 2007 appears to process the receive connectors in the order they were created.  In the standard install, the default Receive Connector is configured to receive e-mail from ALL IP addresses.  If you add the Relay Receive Connector AFTER the default connector, it will never be processed.  You want your Relay to process first.

STEP#4
Create the relay connector

  1. Click New Receive Connector on the Action Bar located at the right of the Exchange Management Console.
  2. Name the connector, click Next.
  3. On the Local Network settings screen, modify as necessary.
    NOTE: These will normally be the same as SCREEN#2 in STEP#2 above
    Click Next
  4. On the Remote Network settings screen, remove the default settings by click the red “X”.
  5. Add in the IP address of your internal SharePoint sever.
    NOTE: If your SharePoint server is hosted on the same physical box as the Exchange Server, be sure to enter in the loop back IP address (IPv4 127.0.0.1, IPv6 ::1) as well as the actual IP address of the server.�
    Click Next
  6. Click New to create the Receive Connector, then click FinishBut wait, you are not done just yet!
  7. Right click on the newly created Received Connector and click Properties to edit the Receive Connector
  8. Select the Permission Groups tab
  9. Check the Exchange Server check box
  10. Select the Authentication tab
  11. Check the Externally Secured check box
    Make sure all other check boxes are NOT checked.
  12. Click apply to save your changes

Your new relay connector should look similar to the screenshots below
(Double click to enlarge)

imageimageimageimage
SCREEN#5                  SCREEN#6               SCREEN#7                SCREEN#8

STEP#5
Recreate the original Receive Connector using the settings noted in Step#2
Your receive connector list should now look like the following:

image

STEP#6
Validate functionality

  1. Verify you can still send e-mail.
  2. Verify you can still receive e-mail.
  3. Verify SharePoint is now sending alerts to the external e-mail.
  4. Verify you have no open relays.  This can be completed via any of the available open relay tests on the internet.

Android 2.2 (FROYO) and Exchange connectivity issues.

At AIS, many of the development staff have become addicted to the Android based phone and their easy to configure and use MS Exchange active sync integration.  So when Verizon performed an OTA push of 2.2 (FROYO FRG01B) and all upgraded phones suddenly stopped synced with our Exchange server, moribund panic ensued.

The issue had to be fixed…. and fast! (lives were at stake here)

Overview
AIS is running

  • Microsoft Exchange 2007 (All patches current)
  • A client access server on the edge network (again, all patches current)
  • SSL certificate from a trusted authority

All in all, a plain vanilla Exchange setup.

Tools of the trade
If you have never used Microsoft’s Exchange Remote Connectivity Tool, you really need to spend some time and check it out!  This tool is a massive timesaver.

https://www.testexchangeconnectivity.com/Default.aspx

The Research
Firing up the Exchange Connectivity test website, we selected and performed the Exchange ActiveSync test.

image

And what do you know, an error appeared

Accept/Require client certificates were found. Set the IIS configuration to Ignore Client Certificates if you aren’t using this type of authentication.

A quick check of our autodiscover site showed the SSL setting are set to ignore

image

The Root Cause
After some research into the settings for all of the virtual directories installed as part of MS Exchange, we discovered the virtual directory Microsoft-Server-ActiveSync was set to “Accept”.  It appears Microsoft’s default install of the ActiveSync end point defaults to “Accept”.  With the new FRG01B build, the Android Exchange implementation does not play nicely with Client Certificates.  Nice!

The Fix
Set the Microsoft-Server-ActiveSync virtual directory’s SSL settings to “Ignore” client certificates via the following steps:

  1. Open Internet Information Services (IIS) Manager
  2. Open the website which contains the Microsoft-Server-ActiveSync virtual directory
    This is usually located in the Default Web Site
  3. Click on the Microsoft-Server-ActiveSync virtual directory
  4. In the center action panel, double click on SSL Setting icon
    image
  5. Click the “Ignore” Client Certificates radio button
    image
  6. Restart IIS
  7. Reset your Mail profile on your handset.